Input validation vulnerability in WordPress 4.9.6

In WordPress 4.9.7, it is possible for a malicious user to upload a file that contains malicious code. This user would need to have access to the admin area and the capability to upload plugins. If a malicious user uploads a PHP file instead of a ZIP file, the plugin extraction will fail, but the PHP file remains in a predictable location in the wp-content/uploads folder. This could allow the malicious user to execute the file, which would be a security risk. This is an issue when the wp-content/plugins directory permissions are set up to stop new plugins from being added.